PT-2023-31873 · Wasmer · Wasmer

Yagehu · Publicado 2023-12-13 · Atualizado 2024-01-03 · CVE-2023-51661

Positive Technologies (AI Summary)

CVSS v3.1

8.4

Alta

Vetor base

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Wasmer versions prior to 4.2.4

Description The issue affects Wasmer, a WebAssembly runtime, allowing Wasm programs to access the filesystem outside of the sandbox. This can lead to service providers running untrusted Wasm code on Wasmer unexpectedly exposing the host filesystem.

Recommendations For versions prior to 4.2.4, update to version 4.2.4 to resolve the issue. As a temporary workaround, consider restricting access to untrusted Wasm code until the update is applied.

Exploit

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

CVE-2023-51661

GHSA-4MQ4-7RW3-VM5J

Produtos afetados

Wasmer

Referências · 11

• 🔥 https://github.com/wasmerio/wasmer/security/advisories/GHSA-4mq4-7rw3-vm5j · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/51xxx/CVE-2023-51661.json · Exploit
• https://github.com/wasmerio/wasmer/commit/e3923612c23123025c26f982d390e34df7df030f · Nota
• https://github.com/wasmerio/wasmer · Nota
• https://github.com/wasmerio/wasmer/commit/4d63febf9d8b257b0531963b85df48d45d0dbf3c · Correção
• https://github.com/wasmerio/wasmer/issues/4267 · Nota
• https://osv.dev/vulnerability/CVE-2023-51661 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-51661 · Nota de Segurança
• https://t.me/cvenotify/66011 · Publicação no Telegram
• https://twitter.com/cracbot/status/1738624110521925844 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-4mq4-7rw3-vm5j · Aviso do Fabricante